[turbofan] Move Math.* builtins to JSCallReducer

This CL also adds speculation to all Math builtins,
and refactors the JSCallReducer.

Bug: v8:7250, v8:7240
Change-Id: Icdaddb767e875bb191939d907f65c7a8dcf79b8b
Reviewed-on: https://chromium-review.googlesource.com/873916
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51426}

src/compiler/js-builtin-reducer.h

@@ -69,39 +69,6 @@ class V8_EXPORT_PRIVATE JSBuiltinReducer final
   Reduction ReduceGlobalIsNaN(Node* node);
   Reduction ReduceMapHas(Node* node);
   Reduction ReduceMapGet(Node* node);
-  Reduction ReduceMathAbs(Node* node);
-  Reduction ReduceMathAcos(Node* node);
-  Reduction ReduceMathAcosh(Node* node);
-  Reduction ReduceMathAsin(Node* node);
-  Reduction ReduceMathAsinh(Node* node);
-  Reduction ReduceMathAtan(Node* node);
-  Reduction ReduceMathAtanh(Node* node);
-  Reduction ReduceMathAtan2(Node* node);
-  Reduction ReduceMathCbrt(Node* node);
-  Reduction ReduceMathCeil(Node* node);
-  Reduction ReduceMathClz32(Node* node);
-  Reduction ReduceMathCos(Node* node);
-  Reduction ReduceMathCosh(Node* node);
-  Reduction ReduceMathExp(Node* node);
-  Reduction ReduceMathExpm1(Node* node);
-  Reduction ReduceMathFloor(Node* node);
-  Reduction ReduceMathFround(Node* node);
-  Reduction ReduceMathImul(Node* node);
-  Reduction ReduceMathLog(Node* node);
-  Reduction ReduceMathLog1p(Node* node);
-  Reduction ReduceMathLog10(Node* node);
-  Reduction ReduceMathLog2(Node* node);
-  Reduction ReduceMathMax(Node* node);
-  Reduction ReduceMathMin(Node* node);
-  Reduction ReduceMathPow(Node* node);
-  Reduction ReduceMathRound(Node* node);
-  Reduction ReduceMathSign(Node* node);
-  Reduction ReduceMathSin(Node* node);
-  Reduction ReduceMathSinh(Node* node);
-  Reduction ReduceMathSqrt(Node* node);
-  Reduction ReduceMathTan(Node* node);
-  Reduction ReduceMathTanh(Node* node);
-  Reduction ReduceMathTrunc(Node* node);
   Reduction ReduceNumberIsFinite(Node* node);
   Reduction ReduceNumberIsInteger(Node* node);
   Reduction ReduceNumberIsNaN(Node* node);

src/compiler/js-call-reducer.h

@@ -115,6 +115,12 @@ class V8_EXPORT_PRIVATE JSCallReducer final : public AdvancedReducer {
 
   Reduction ReduceSoftDeoptimize(Node* node, DeoptimizeReason reason);
 
+  Reduction ReduceMathUnary(Node* node, const Operator* op);
+  Reduction ReduceMathBinary(Node* node, const Operator* op);
+  Reduction ReduceMathImul(Node* node);
+  Reduction ReduceMathClz32(Node* node);
+  Reduction ReduceMathMinMax(Node* node, const Operator* op, Node* empty_value);
+
   // Returns the updated {to} node, and updates control and effect along the
   // way.
   Node* DoFilterPostCallbackWork(ElementsKind kind, Node** control,

test/mjsunit/math-deopt.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license
+// that can be found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+(()=> {
+  function f(a) {
+    return Math.abs(a);
+  }
+  f(1);
+  f(1);
+  %OptimizeFunctionOnNextCall(f);
+  f("100");
+  %OptimizeFunctionOnNextCall(f);
+  f("100");
+  assertOptimized(f);
+})();
+
+(()=> {
+  function f(a) {
+    return Math.min(1,a);
+  }
+  f(1);
+  f(1);
+  %OptimizeFunctionOnNextCall(f);
+  f("100");
+  %OptimizeFunctionOnNextCall(f);
+  f("100");
+  assertOptimized(f);
+})();
+
+(()=> {
+  function f(a) {
+    return Math.pow(a,10);
+  }
+  f(1);
+  f(1);
+  %OptimizeFunctionOnNextCall(f);
+  f("100");
+  %OptimizeFunctionOnNextCall(f);
+  f("100");
+  assertOptimized(f);
+})();
+
+(()=> {
+  function f(a) {
+    return Math.clz32(a);
+  }
+  f(1);
+  f(1);
+  %OptimizeFunctionOnNextCall(f);
+  f("100");
+  %OptimizeFunctionOnNextCall(f);
+  f("100");
+  assertOptimized(f);
+})();
+
+(()=> {
+  function f(a) {
+    return Math.imul(a, 10);
+  }
+  f(1);
+  f(1);
+  %OptimizeFunctionOnNextCall(f);
+  f("100");
+  %OptimizeFunctionOnNextCall(f);
+  f("100");
+  assertOptimized(f);
+})();

test/unittests/compiler/node-test-utils.cc

@@ -2188,6 +2188,7 @@ IS_UNOP_MATCHER(Word32Clz)
 IS_UNOP_MATCHER(Word32Ctz)
 IS_UNOP_MATCHER(Word32Popcnt)
 IS_UNOP_MATCHER(Word32ReverseBytes)
+IS_UNOP_MATCHER(SpeculativeToNumber)
 #undef IS_UNOP_MATCHER
 
 // Special-case Bitcast operators which are disabled when ENABLE_VERIFY_CSA is

test/unittests/compiler/node-test-utils.h

@@ -480,6 +480,8 @@ Matcher<Node*> IsWord32ReverseBytes(const Matcher<Node*>& value_matcher);
 
 Matcher<Node*> IsStackSlot();
 
+Matcher<Node*> IsSpeculativeToNumber(const Matcher<Node*>& value_matcher);
+
 // Helpers
 static inline Matcher<Node*> IsIntPtrConstant(const intptr_t value) {
   return kPointerSize == 8 ? IsInt64Constant(static_cast<int64_t>(value))